The vulnerability resides in the Linux kernel wireless subsystem, where cfg80211_is_element_inherited() reads the first octet of an element’s data without first validating that data exists. The likely attack vector is a crafted IEEE 802.11 management frame transmitted by an attacker‑controlled access point, based on the description. When a zero‑length WLAN_EID_EXTENSION element is processed, a single byte is read beyond the element boundary, causing a slab‑out‑of‑bounds read. This read can expose the contents of kernel memory to an attacker who can craft a malicious IEEE 802.11 frame that is parsed by a vulnerable host. The effect is a potential leak of kernel data, but the description does not indicate further exploitation such as privilege escalation or code execution.

All Linux kernel implementations that contain the unpatched cfg80211 code. The vulnerable path is present in every kernel version distributed prior to the integration of the recent fix, regardless of distribution. No specific version numbers are listed in the data, so any system running an affected kernel should be considered at risk.

The flaw is a read‑only memory disclosure. Based on the description, it is inferred that an attacker can trigger it remotely from any wireless access point by transmitting a malicious IEEE 802.11 frame that includes a zero‑length extension element. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 7.1 indicates a high severity, and the located out‑of‑bounds read in the kernel suggests limited impact confined to kernel memory leakage.